0

When building a mobile app, and using services3 and/or my custom module, I have a specific requirement:

I want anonymous users to be able to receive their password, in plaintext, in their email, if they give me their email address and if their account exists. If their account doesnt exist, I want to send a different email. I have trouble finding out where to start.

Services has user/request_new_password, and user/password_reset, but both seem to send out a one-time-link through email. Is there an easy way to modify those handlers ?

Otherwise, what would be a good appraoch in my own module ? Just create an entity_metadata_wrapper around the user, set the pass, call save and send the email ?

PS. Please dont start a discussion about that workflow, there is a reason for it. If you have additional advice for security without changing the workflow as described, I'm all ears.

  • I hope you went through this post – shrish Oct 30 '14 at 10:24
  • Now I have, thanks. Its fine to generate a new password and mail that out once. It should ofcourse stay encrypted in the db. – commonpike Oct 30 '14 at 13:48
  • great! :) you can answer your own question and mark it as answered. – shrish Oct 30 '14 at 14:49
  • Oh. Well I'd prefer the system would go through the hoops when changing the password, if it has any hoops. Caches to clean up, sessions to invalidate .. I'd rather hook into something existing, if I can. – commonpike Oct 30 '14 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.